From 2cc1e1f1d967056ae995c5db3ec15adc89d5cc7e Mon Sep 17 00:00:00 2001
From: Yves Rutschle <git1@rutschle.net>
Date: Tue, 3 Feb 2026 21:00:40 +0100
Subject: [PATCH] add CAP_NET_RAW in systemd configuration to support
 transparent proxying

---
 ChangeLog                            |  4 ++++
 scripts/systemd.sslh-select@.service | 27 ---------------------------
 scripts/systemd.sslh@.service        |  6 +++---
 3 files changed, 7 insertions(+), 30 deletions(-)
 delete mode 100644 scripts/systemd.sslh-select@.service

diff --git a/ChangeLog b/ChangeLog
index 246d176..1e5b85d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,10 @@ vNEXT:
 	Mixed IPv4/IPv6 proxyprotocol setups will move both
 	addresses to IPv6 format on the server side.
 
+	Add CAP_NET_RAW to systemd config so transparent
+	proxying can work. Removed sslh-select systemd file:
+	don't repeat the same configuration file!
+
 v2.3.0:
 	Added `max_connections` setting to `listen` and
 	`protocol` configuration; see the
diff --git a/scripts/systemd.sslh-select@.service b/scripts/systemd.sslh-select@.service
deleted file mode 100644
index bbfe073..0000000
--- a/scripts/systemd.sslh-select@.service
+++ /dev/null
@@ -1,27 +0,0 @@
-[Unit]
-Description=SSL/SSH multiplexer (select mode) for %I
-After=network.target
-
-[Service]
-EnvironmentFile=/etc/default/sslh
-ExecStart=/usr/sbin/sslh-select -F/etc/sslh/%I.cfg -f $DAEMON_OPTS
-KillMode=process
-#Hardening
-PrivateTmp=true
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-SecureBits=noroot-locked
-ProtectSystem=strict
-ProtectHome=true
-ProtectKernelModules=true
-ProtectKernelTunables=true
-ProtectControlGroups=true
-MountFlags=private
-NoNewPrivileges=true
-PrivateDevices=true
-RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
-MemoryDenyWriteExecute=true
-DynamicUser=true
-
-[Install]
-WantedBy=multi-user.target
diff --git a/scripts/systemd.sslh@.service b/scripts/systemd.sslh@.service
index 82251cc..ea97293 100644
--- a/scripts/systemd.sslh@.service
+++ b/scripts/systemd.sslh@.service
@@ -1,5 +1,5 @@
 [Unit]
-Description=SSL/SSH multiplexer (fork mode) for %I
+Description=SSL/SSH multiplexer for %I
 After=network.target
 
 [Service]
@@ -8,8 +8,8 @@ ExecStart=/usr/sbin/sslh -F/etc/sslh/%I.cfg -f $DAEMON_OPTS
 KillMode=process
 #Hardening
 PrivateTmp=true
-CapabilityBoundingSet=CAP_NET_BIND_SERVICE
-AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_SETGIT CAP_SETUID CAP_NET_BIND_SERVICE CAP_NET_RAW
+AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW
 SecureBits=noroot-locked
 ProtectSystem=strict
 ProtectHome=true